Miggo at BlackHat 2026!
Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability is a systemic SQL injection issue within the pREST application, affecting multiple code paths where SQL queries are dynamically constructed using user-provided input. The analysis of the provided patch confirms several vulnerable functions and the remediation strategies applied.
The root cause is the use of fmt.Sprintf and text/template to build SQL queries by concatenating or substituting unvalidated and unsanitized user input. This allows an attacker to inject arbitrary SQL code.
The provided commit 47d02b87842900f77d76fc694d9aa7e983b0711c addresses these issues in several key functions:
ReturningByRequest: The _returning parameter was directly concatenated. The fix involves validating it as an identifier and then properly quoting it.JoinByRequest: The join type was taken directly from user input. The fix is to use a whitelist of allowed join types.GroupByClause: The HAVING clause value was not sanitized. The fix adds logic to differentiate between numeric and string values, and to escape single quotes in strings.ParseScript: SQL templates were rendered with user data without escaping. The fix moves towards parameterized queries by introducing new template functions that separate the query structure from the user-provided values.These changes indicate that any runtime profile during exploitation would likely show these functions in the stack trace, as they are responsible for processing the malicious input and constructing the vulnerable SQL queries. The identified functions are the points where the application fails to properly neutralize special elements used in an SQL command.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| github.com/prest/prest/v2 | go | < 2.0.0-rc2 |